Cross-browser firefox/konqueror malware on Ubuntu Dapper

[Michael V. De Palatis]

> On 8/4/06, Charlie Zender <zender at uci.edu> wrote:
> >
> > Help! My Ubuntu Dapper laptop has malware infecting its browswers!
> > About three weeks ago my Firefox browser started showing signs of
> > malware infestation. The symptoms are that the browser re-directs
> > my normal requests to click-for-pay sites www.ownbox.com and usseek.com.
> > To get rid of this malware I've tried
> >
> > 0. Re-booting
> > 1. Purging and re-installing firefox
> > 2. Deleting my ~/.firefox directory
> > 3. Running Konqueror instead
> >
> > None of these work. After a few hours of browsing the re-directs to
> > the click-for-pay sites begin again. So this cross-browser malware
> > has somehow installed itself in files that survive re-boots and
> > browser re-installs. I've found other reports of this malware related
> > to Windows PCs, but no instructions on how to erase it from Linux.
> > Any ideas
> >
> > 1. How to find it's source and erase it completely from disk?
> > 2. How to tell if it's phoning home my passwords?
> > 3. Sites that discuss this particular malware?
> >
> > Thanks,
> > Charlie

One question: Is your computer behind another computer that is
connecting to the Internet? That is, does your Linux machine get its
IP from, say, a Windows PC that is the one directly connected and
sharing the connection? If that is the case, it may be a problem with
that machine rather than the Linux one.

I have never heard of any malware affecting Linux, so if the above is
the case, that might be the problem. Otherwise, I hope malware doesn't
start becoming as commonplace on Linux as it is on Windows...

Mike